Subject: [Idr] packet-rate action for flowspec

From: Wesley Eddy <[email-masked]>
Date: Mon, 23 Nov 2015 21:38:00 -0500

Hello, I'd like to make the working group aware of a very short new draft:
https://tools.ietf.org/html/draft-eddy-idr-flowspec-packet-rate-00

The idea is to enhance the set of available flowspec actions, by 
allocating a community value to indicate packets-per-second rate-limits.

We had heard from some operators who make use of flowspec that this 
would be desirable, and had previously included this idea as one part of 
an earlier draft (draft-eddy-idr-flowspec-exp).  There was a bit of 
feedback indicating that at least this packet rate limitation may be a 
reasonable idea to take forward.

One important question, not yet addressed in this draft, has been raised 
by Qiandeng Liang.  In brief, it is how to properly handle the 
concurrence of both a traffic-rate and a packet-rate action in a 
flowspec advertisement.  To me, it seems this could safely be 
implementation dependent, but would like to explore other thoughts the 
working group may have.

Any other feedback is welcome, as well.

---

From: "Aseem Choudhary (asechoud)" <[email-masked]>
Date: Tue, 24 Nov 2015 08:13:06 +0000

Why not just have either of the two not both?

Aseem

On 11/23/15, 6:38 PM, "Wesley Eddy" <[email-masked]> wrote:

>_______________________________________________
>Idr mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/idr

---

From: "Acee Lindem (acee)" <[email-masked]>
Date: Tue, 24 Nov 2015 12:08:11 +0000

Hi Wesley, 
I don’t know that I agree with the basis premise, "In some cases, it may
be easier, faster, or more relevant to perform accounting and
decision-making based on quantities of packets per second.  It is
desirable to specify rate limits in terms of the number of packets per
second, and not just the number of bytes per second.” When is it desirable
to use packets rather than bytes?
Thanks,
Acee 

On 11/23/15, 9:38 PM, "Idr on behalf of Wesley Eddy" <[email-masked]

---

From: Wesley Eddy <[email-masked]>
Date: Tue, 24 Nov 2015 09:05:38 -0500

> to use packets rather than bytes?

Hi Acee, this is a fair question, and I can easily answer it. Perhaps it 
should be more clearly worded in the draft.

Of course, when people think of denial-of-service attacks, it's natural 
to assume high-volume attacks that consume hundreds of Gbps.  However, 
there are several other types of attack that do not require large 
amounts of bandwidth.

One example that is easy to understand is the classic TCP SYN flood.  
This doesn't require high bandwidth (SYN segments are small packets), 
but it uses many small SYN packets to chew up server resources for 
tracking half-opened connections.  The number of SYNs per second that an 
attacker generates is how the attack is properly measured, not the bitrate.

There are other attacks similar in this regard, that do not require a 
high bitrate in order to be successful.

---

From: "Acee Lindem (acee)" <[email-masked]>
Date: Tue, 24 Nov 2015 14:08:46 +0000

Hi Wesley, 

>high bitrate in order to be successful.

Ok - I can see how this would be useful. It would be good to provide this
example in the introduction and, possibly, even the abstract.

Thanks,
Acee

---

From: Wesley Eddy <[email-masked]>
Date: Tue, 24 Nov 2015 09:12:08 -0500

> example in the introduction and, possibly, even the abstract.

Excellent; many thanks for your feedback on this, and helping to clarify it.

---

From: Wesley Eddy <[email-masked]>
Date: Tue, 24 Nov 2015 09:15:18 -0500

That is certainly a possibility.  I'm not an expert on how various 
implementations handle multiple actions (community values) associated 
with a flowspec, and think hearing from multiple vendors on this is 
important.

---

From: Jeffrey Haas <[email-masked]>
Date: Tue, 24 Nov 2015 12:47:17 -0500

Wes,

On Tue, Nov 24, 2015 at 09:15:18AM -0500, Wesley Eddy wrote:
> implementations handle multiple actions (community values)
> associated with a flowspec, and think hearing from multiple vendors
> on this is important.

The main challenge hitting all of these new features for flowspec is
figuring out the interaction.  When there's overlap, the behavior needs to
be clear so we end up with interop.

For my part, I'd suggest that when both rate and throughput actions are
understood that rate should have precedence.  We should not be trying to
apply both simultaneously.

-- Jeff

---

From: "Aseem Choudhary (asechoud)" <[email-masked]>
Date: Tue, 24 Nov 2015 20:15:52 +0000

Hi Wesley,

<snip>
The maximum value that a 32-bit unsigned integer could hold would
      limit to specifying under 2.15 Gpps (2.15 billion packets per
      second).  For large or high-performance networks especially in the
      future, this may not be sufficient.  The maximum floating point
      value is much higher (on the order of 10^38) and should be future-
      Proof.

</snip>

For all use-cases, it doesn¹t have to be counted in Billions to call it
attack.
A number much lower will qualify as well.

-thanks,
Aseem

---

From: "Aseem Choudhary (asechoud)" <[email-masked]>
Date: Tue, 24 Nov 2015 20:20:33 +0000

Actually, if it has to be counted in Billions, the very purpose will be
defeated as by then it would have used lots of processing power.

-thanks,
Aseem